<div dir="ltr">Bill, this suggestion is related to my previous post where I was inquiring if there is a way to edit NameID in Saml response:<div><br></div><div><a href="http://lists.jboss.org/pipermail/keycloak-dev/2016-September/008027.html">http://lists.jboss.org/pipermail/keycloak-dev/2016-September/008027.html</a><br></div><div><br></div><div>We have a need to implement this protocol now. Assuming that you are considering adding this feature sometime in future, would you be able to guide us on how we can implement this now at our end? And if we can implement this now, will we be able to merge it to the master branch? Any guidance you can provide on how we can implement this ourselves at this time would be very useful. Thank you! </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 12, 2016 at 7:25 AM, Bill Burke <span dir="ltr"><<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p>Good feedback. We'll eventually open up the protocol mapper spi
so that the entire assertion can be modified.<br>
</p><div><div class="h5">
<br>
<div>On 9/11/16 7:43 PM, Rashmi Singh wrote:<br>
</div>
</div></div><blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div>Looking at the keycloak source code to see how NameID value
is set in the SAML response, we came across SamlProtocol class
that has the following method:</div>
<div><br>
</div>
<div> protected String getNameId(String nameIdFormat,
ClientSessionModel clientSession, UserSessionModel
userSession) {</div>
<div> if (nameIdFormat.equals(JBossSAML<wbr>URIConstants.NAMEID_FORMAT_<wbr>EMAIL.get()))
{</div>
<div> return userSession.getUser().getEmail<wbr>();</div>
<div> } else if (nameIdFormat.equals(JBossSAML<wbr>URIConstants.NAMEID_FORMAT_<wbr>TRANSIENT.get()))
{</div>
<div> // "G-" stands for "generated" Add this for the
slight possibility of collisions.</div>
<div> return "G-" + UUID.randomUUID().toString();</div>
<div> } else if (nameIdFormat.equals(JBossSAML<wbr>URIConstants.NAMEID_FORMAT_<wbr>PERSISTENT.get()))
{</div>
<div> return getPersistentNameId(clientSess<wbr>ion,
userSession);</div>
<div> } else if (nameIdFormat.equals(JBossSAML<wbr>URIConstants.NAMEID_FORMAT_<wbr>UNSPECIFIED.get()))
{</div>
<div> // TODO: Support for persistent NameID
(pseudo-random identifier persisted in user object)</div>
<div> return userSession.getUser().getUsern<wbr>ame();</div>
<div> } else {</div>
<div> return userSession.getUser().getUsern<wbr>ame();</div>
<div> }</div>
<div> }</div>
<div><br>
</div>
<div>which is just returning either email or username because of
which we are restricted in the value that can be set for the
NameID. We are not able to set NameID to any value other than
this. With our customers, we have seen lot of cases where
users have different IDs across SPs. With the current
implementation in KeyCloak, it seems we can only return Name
or Email as NameID. Ideally in case of “Unspecified” format,
we should have a mechanism to map Name ID to any of user
property/attribute. Do you have any plans to add support for
this use case?</div>
<div><br>
</div>
<div>With regard to solving this problem, one option could be to
implement a protocol mapper that can be used to map any user
property/attribute to NameID. Currently protocol mapper can
only be used to return saml:Attribute, so writing a new
protocol mapper specifically for requesting NameID would be
useful. Is this feasible? And, do you have any plans to add
support for this usecase?</div>
<div><br>
</div>
<div>If you are not planning to implement this, are there any
design or implementation level inputs/help you can provide on
this? And if we implement this protocol mapper from our side,
would it be possible to merge it back to the master branch?</div>
<div><br>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><pre>______________________________<wbr>_________________
keycloak-dev mailing list
<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</div>
<br>______________________________<wbr>_________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-dev</a><br></blockquote></div><br></div>